Oregon Zoo says hackers stole payment card information of approximately 118k visitors

Portland-based Oregon Zoo has announced a significant data security incident that involved threat actors siphoning payment card information of visitors from its online ticketing service.

In a filing with the Office of Maine Attorney General, Oregon Zoo said that on June 26, it became aware of suspicious activity within its online ticketing service. The zoo authority immediately launched an investigation, with assistance from external cyber security experts, to determine the nature and scope of the incident.

“On July 22, 2024, the investigation determined that an unauthorised actor redirected customers’ transactions from the third-party vendor who processed online ticket purchases, potentially obtaining payment card information from Dec. 20, 2023, to June 26, 2024,” Oregon Zoo said.

“As a precaution, we reviewed all transactions from this period to identify anyone whose payment card information may have been affected.”

The zoo said that the compromised data included visitors’ names, payment card numbers, CVVs and expiration dates. Its filing with the Maine state regulator also revealed that at least 117,815 individuals were impacted as a result of the data security incident.

“Our response to this event included initiating an investigation and notifying federal law enforcement. We are reviewing our policies and procedures to reduce the likelihood of similar events in the future. Additionally, we decommissioned the previous online ticketing website and rebuilt a new secure site for online ticket purchases,” zoo authorities added.

Oregon Zoo has advised all affected individuals to regularly monitor their credit reports, account and benefit statements and report any suspicious activity to law enforcement authorities, including the police and state attorney general. It has also offered one year of complimentary identity protection and credit monitoring services through Cyberscout to all affected individuals.